Extracted

Extracted

• • Target
    POTWIERDZENIE_TRANSAKCJI_20231019162300.exe
  • Size 1.3MB
  • SHA256 b916d475339eb0e64ad8e4e8bf897adb317c8add907ca4f72c1b7fda76cd8550
  • MD5 e9d6f4cce8a917ed0259a60eb10d61ba
  • SHA1 f94d2599cad2fc8f566378c9b62424e96abfdc6e
  • SHA512 9afdfee14e3148616451d701f2594200e3d0484777c1ecb5a19ee89e285488f6e1c98f4297a2a784a9a17b166a5718f1997668ad69a29d6c82d1da954bae250b
  • SSDEEP 24576:Kyc6kLrdGaBGMAxBzftIdrB3zkhWb/I2Zeap2oNis2aNtvM1:qN4a6LfIzkhWb/IebII2ck1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2